Add docker's add/drop capabilites

Add docker's add/drop capabilites
Can we fast-forward a bit and think about the abstraction here?  I don't want to define this just in terms of what docker supports.  Internally we use capabilities to control many things (some of which are wrong, but some are OK).  Is the value of these strings defined?  Should we define a list of valid values, starting with the POSIX caps that docker supports?

Then, what about guarding this?  We have guards for privileged such that an admin has to actually enable it - do we need something similar here?